Higaisa

APT / StateG0126 ↗
Origin🇰🇵 Coreia do Norte
Techniques (MITRE ATT&CK)28
SourceMITRE ATT&CK
State sponsor: Korea (Republic of)Target categories: Government
Targeted regions: China · North Korea · Japan · Nepal · Singapore · Russia · Poland · Switzerland

About the group

Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity48
Impact: High
T1566.001T1053.005T1547.001T1016ENTRYInitial accessSpearphishingAttachmentEXECExecutionScheduled TaskPERSPersistenceRegistry Run Keys/ Startup FolderDISCDiscoverySystem NetworkConfiguration Dis…EXFILExfiltrationScheduled Transfer

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 28

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Initial access
Spearphishing Attachment
Execution
Scheduled TaskWindows Command ShellVisual BasicJavaScriptNative APIExploitation for Client ExecutionMalicious File
Persistence
Registry Run Keys / Startup Folder
Discovery
System Network Configuration DiscoveryProcess DiscoverySystem Information DiscoverySystem Time DiscoveryLocal Storage Discovery
Command and control
Protocol or Service ImpersonationWeb ProtocolsInternal ProxySymmetric Cryptography
Exfiltration
Scheduled TransferExfiltration Over C2 Channel
stealth
Binary PaddingEncrypted/Encoded FileCompressionMasquerade Task or ServiceDeobfuscate/Decode Files or InformationXSL Script ProcessingHidden WindowDLL

Exploited vulnerabilities 1

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2018-0798HIGHEPSS 95%KEV MITRE ATT&CK

Known infrastructure 6

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

sha256_hash7353d8c8cbfa5381e556c58370e0f3e6bc0e87f80c0d68578a014f9c34ef681fGh0stRATmalwarebazaar
sha256_hash8152d51a72dde734c0e17832263a8884070848a88707731c5e674caae62bcce8Gh0stRATmalwarebazaar
sha256_hash2f4f3bce4e588901683edc36575b14e829d70007673a001e13ab9d7d18c6fa8fGh0stRATmalwarebazaar
sha256_hash96c0911c225219cfd380076f5196d7ee87c617cddb968d3d465122473e20d6fbGh0stRATmalwarebazaar
sha256_hash0e8553970999b60c3a0a2637e0c282ca52b33d3e3ae88c99b6fa426bddc0075dGh0stRATmalwarebazaar
sha256_hash69e2433df06b829e98e5a6c8f552b9371795fb65df62fa4cfb7362970d1ce744Gh0stRATmalwarebazaar

References

Higaisa uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →